Hacker News Reader

Comment by andrewvc | Hacker News Reader

Pof has to store passwords in plaintext, sine they include it intentionally in a weekly email reminding you to login.. Yes. I know.

At any rate, anyone who has actually used pof can tell its been hacked together by substandard developers. No polish, a bizarre ui, and just general weirdness. This is the kind of shodiness I'd expect.

View on HN

No they don't have to. They can email users a link with an embedded hash that automatically logs them in. These links can expire. This is similar to how an email password reset works.

But the user could've still forgotten it though..

The system quellhorst describes does not require the user to know the password, or even their own username. They click the link in the email and they are automatically logged in; it's an alternate authentication scheme. If they have lost their password that's a separate issue that should be handled separately but similarly by emailing them a link, again with an 'embedded hash', that allows them to reset their password.

The assumption of course is that they and only they can access the email address specified in their account profile. If that's not the case then this all becomes a bit more problematic.

Yeah, I agree it's unbelievable stupid. that was meant as a tongue in cheek statement, hence the 'yeah, I know' at the end.

OKCupid used to use tokens fwiw.

At any rate, anyone who has actually used pof can tell its been hacked together by substandard developers.

Developer, not developers.

It started as a part time side project, and until 2007 Marcus Frind was the sole employee.

2007 is over three years ago.

Running a site as large as plenty of fish solo likely doesn't leave one with a ton of time for new development, unless he completely ignores customer service emails.

The grandparent is saying that POF should be considered to have been written by one developer, because that's what it was until 2007.

You can encrypt a password in the database and still keep it retrievable (for things like this). Storing it in plain text, however, is inexcusable.

Storing passwords using reversible encryption is not much better than plaintext.

Not much better is still better.

And it can be significantly better. In a past situation I stored sensitive information using public/private keys. Even if you got complete access to the webservers and database, you still could not decrypt that information. It would only be useful if you had access to the private key, which was much more securely controlled.

Iirc okcupid would let you login with one click via email via a token. I'm fairly sure they stopped doing this a while ago. A much better solution, with a better experience as well.

Neither way is ideal, but making it easier to login probably helps viral growth.

Reply on news.ycombinator.com